Unconditional security of continuous- variable quantum key distribution 
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The unconditional security of continuous-variable quantum key distribution is established for all schemes 
based on the estimation of the channel loss and excess noise. It is proved that, in the limit of large keys, 
Gaussian attacks are asymptotically optimal among the most general (coherent) attacks, where the transmission 
is tapped using arbitrary ancillas and stored in a quantum memory as a whole. Then, it is shown that the 
previously derived bounds on the achievable secret key rates against collective attacks remain asymptotically 
valid for arbitrary coherent attacks. 
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Quantum key distribution (QKD) is probably to date the 
most successful application of quantum information sciences. 
This technique Hi], based on the transmission of quantum sig- 
nals between two authorized parties (Alice and Bob), enables 
them to generate a random bit string, called secret key, which 
is provably unknown to an eavesdropper (Eve) with arbitrary 
computational and technological power. The secret key rate K 
is essentially given by the difference between Eve and Bob's 
uncertainties about the data sent by Alice. Denoting Alice, 
Bob, and Eve's classical variables (after measurement) by a, 
6, and e, one has 



K = H{a\e) ~ H{a\b), 



(1) 



where the exact definition of the conditional entropy H de- 
pends on the type of attacks considered: individual, collective 
or coherent. The second term of the rh.s. of Eq. ([T]) is sim- 
ply measured while running the protocol since it is accessible 
to the legitimate parties, so only the first term needs to be 
estimated, or, more precisely, bounded below. For individual 
attacks, H{a\e) denotes Shannon conditional entropy, and can 
be calculated explicitly for a Gaussian attack. For collective 
attacks, it must be replaced by S{a\E), which denotes von 
Neumann conditional entropy and can again be computed ex- 
actly for a Gaussian attack. Physically, this means that Eve 
accesses the Holevo information about Alice's variable a by 
making an appropriate measurement on her quantum system 
E (instead of accessing the Shannon information between a 
and her measurement e). For individual and collective attacks, 
Gaussian attacks have been proved to be optimal 10, S 01 as 
they minimize H{a\e) and S{a\E) for a given channel trans- 
mission and excess noise, which largely simplifies the security 
analysis. 

To address unconditional security, one must consider the 
most general class of attacks, namely coherent attacks, and the 
first term of the r.h.s. of Eq. ([T]) must be replaced by the quan- 
tum smooth min-entropy S'^:^,^{a\E), as introduced in [Si]. The 
min-entropy (or Renyi entropy of parameter oo) is particu- 
larly relevant for the security study of cryptographic protocols 
as it quantifies the guessing probability, i.e., the probability 



that Eve correctly guesses the value of the classical variable 
a Replacing Shannon or von Neumann entropies by min- 
entropies encapsulates the idea that the entire transmission, 
made of n symbols, is tapped as a whole. The min-entropy can 
be viewed as a one-shot quantity, while Shannon or von Neu- 
mann entropies are computed on a single-symbol basis and 
get a meaning only by assuming that there are many identical 
transmissions. Not surprisingly, these two types of entropies 
become asymptotically equal in the latter case, the quantum 
smooth min-entropy of a power state p^" tending to (n times) 
the von Neumann entropy of p in the limit n ^ oo. 

QKD protocols can be classified in discrete-variable pro- 
tocols, based on photon counting (e.g., BB84 |0]), and 
continuous-variable protocols, based on homodyne detection 
|8i|. We will be concerned with this latter class of protocols in 
the following, in particular those based on the Gaussian modu- 
lation of Gaussian (coherent or squeezed) states. For discrete- 
variable protocols, the unconditional security can be proved 
by using a quantum de Finetti theorem stating that symmet- 
ric states are "close to" product states An n-partite state 
is said to be symmetric if it is invariant under any permu- 
tation of its subsystems. If the protocol is symmetric, one 
concludes that the smooth min-entropy of the symmetric state 
shared by Alice and Bob is asymptotically equal to {n times) 
the von Neumann entropy, as used for calculating the secret 
key rates against collective attacks. This proves that coherent 
attacks are not more powerful than collective attacks. Unfor- 
tunately, this approach cannot be applied as such to the secu- 
rity of continuous-variable protocols against coherent attacks 
as it would require extending a de Finetti theorem to infinite 
dimensional Hilbert spaces. Such an extension, however, has 
just been shown to hold provided that experimentally verifi- 
able conditions are fulfilled iH. 

In this Letter, it is shown that there exists another way to ad- 
dress the security of continuous-variable QKD, which circum- 
vents the need for a de Finetti theorem in infinite dimension. 
The idea is to exploit the extremality of Gaussian states with 
respect to the (non smooth) min-entropy. The extremality of 
Gaussian states has led to powerful results in the past, as it was 



2 



used, e.g., to prove the optimality of Gaussian attacks among 
collective attacks |j3[|. The point of using Gaussian states here 
is that even if symmetric Gaussian states are not known to 
be exponentially close to product states (although some pre- 
liminary results in this direction have been obtained 111 ill ), 
their min-entropy is equal to the min-entropy of a well-defined 
product state. Then, using the link between the smooth min- 
entropy and the von Neumann entropy, one shows that the se- 
cret key rate against coherent attacks can be asymptotically 
bounded below by a secret key rate against Gaussian collec- 
tive attacks. This establishes the proof of the unconditional 
security of continuous-variable QKD against the most general 
attacks. 

Note that unconditional security of QKD protocols can also 
be proved by showing their equivalence to some entangle- 
ment purification protocols. This strategy can be used both 
for discrete-variable lll2ll and continuous-variable lIlSll proto- 
cols but, unfortunately, does not allow to derive a secret key 
rate. 

Sketch of the proof. The central object of the proof is thus 
the smooth min-entropy S^^^{a\E), which we will also often 
denote as S',^in(/3) in the following, with p being the 2n-mode 
state shared by Alice and Bob. As in all security proofs of 
QKD, Eve is given a purification of the state p, and it can be 
proved that the smooth min-entropy is solely a function of p. 
The first step of the proof is to show that Gaussian states are 
extremal with respect to the non-smooth min-entropy Smm{p) 
as defined later on, that is, S'min(p) > S^inip''^) where p^ 
refers to the Gaussian state with the same first- and second- 
order moments as p. This is proved using a powerful theorem 
on the extremality of Gaussian states resulting from a quantum 
central limit theorem I14)il . Then, one moves on to the smooth 
min-entropy, defined as 



,(/9) := sup S'min(p)- 

p:||p-p||l<e 



(2) 



where e > denotes the smoothness, a parameter quantifying 
the quality of the key that can be distilled |@1, and where 1 1 • 1 1 1 
stands for the trace norm. Using the fact that, for a given state 
p with bounded energy, the function e i-^ ^Linip) contin- 
uous in e = 0, we conclude that S^^^{p) > S^^^{p^) — e', 
where e' > continuously tends to zero as e — > 0. Next, 
the invariance of the QKD protocol under permutations of the 
exchanged signals allows us to assume that the state p is sym- 
metric. This property directly translates into the same prop- 
erty for p*^, hence of its 4n x An covariance matrix F, which 
can then be written as 
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(3) 



where 7 and cr are symmetric 4x4 matrices |1 1[|. The covari- 
ance matrix F can be diagonalized via an appropriate sym- 



plectic transformation S, giving 

F' = S-FS*^ = [7 + (n - l)a] F" 



(4) 



where F" = ?^0"J~/(7 — cr). Since is invariant 

under S, one only needs to consider that Alice and Bob share 
a 2n-mode Gaussian state with this diagonal covariance ma- 
trix F'. Moreover, since tracing over a subsystem can only 
decrease the smooth min-entropy, we get a bound by consid- 
ering only a 2(n — l)-mode Gaussian state with covariance 
matrix F", which turns out to be the tensor product of (n — 1) 
individual 2-mode Gaussian states pind with covariance matrix 
7- a. Accordingly, we have > Sl^,{pfJ^ The 

last step consists of approximating the smooth min-entropy of 
a power state with the von Neumann entropy of the state, or, 
more precisely, S'^j„(/9®]"~^^) > (n— l)[5(a|£') — 5], where, 
for any e > 0, the parameter 5 > tends to zero at the limit 
n ^ 00. This concludes the proof that coherent attacks are 
not more powerful than collective attacks, exactly as in the 
finite-dimensional case. Let us now proceed with the details 
of our proof. 

Non-smooth min-entropy. Our starting point is the non- 
smooth quantum (conditional) min-entropy Smm{<A^) in- 
troduced in ||I15>]. Remember first that the min-entropy (or 
Renyi entropy of parameter 00) of a state p is defined as 



Soo{p) := -logAn,ax(p), 



(5) 



where A^ax (p) stands for the maximum eigenvalue of p. We 
may then evaluate Soo for the Hermitian operator 



PAE 
<JE 



-1/2 
E PAE CTj^ 



1/2 



(6) 



with PAE being the density operator on Ha ^He character- 
izing Alice and Eve's joint state, and erg being a nonnegative 
trace-one operator on He whose support contains the support 
of pE ^ tiAipAE)- By taking the supremum of the result- 
ing quantity over all nonnegative trace-one operators as, one 
obtains the (conditional) min-entropy of A given E, namely 
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( P^E 

\ (7E 



(7) 



In the present context, we consider Alice's system A to be 
classical, which boils down to substituting A with the classi- 
cal variable a in the above expressions. In the entanglement- 
based equivalent picture of QKD, this means that Alice's mea- 
surement is treated as a unitary process and her measurement 
device as a physical system, noted a. Thus, a corresponds ei- 
ther to a real variable for homodyne-detection protocols or a 
pair of real variables for heterodyne-detection protocols. 

The next step is to show that the min-entropy Smm{o\E) 
of a conditional on is a well-defined function of the 2n- 
mode state p shared by Alice and Bob; this property will 
then extend to the smooth min-entropy S^-^^{a\E). Without 
loss of generality. Eve is assumed to hold a purification of p. 
Then, since all purifications are unitarily equivalent on Eve's 
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side and since the min-entropy is invariant under unitaries, the 
quantities Smin{a\E) and 5,^-,i|,(a|£') only depend on p. Now, 
to make both these quantities well-defined, it is necessary to 
assume that a is discretized, albeit with an arbitrarily small 
step. This is consistent with the actual experiments since any 
practical measurement has a finite precision. We note that the 
exact value of the discretization step does not matter, as a is 
discretized similarly in the second term of the rh.s. of Eq. ([U, 
namely H{a\b), and the terms linked to this discretization can- 
cel each other when one computes the key rate. Note also that 
the (practical) discretization of a is not contradictory with the 
fact that we consider an infinite-dimensional Hilbert space. 

Extremality of Gaussian states. Let us show that the min- 
entropy is extremal for Gaussian states, that is, H^i„{p) is 
bounded below by the same quantity computed with the Gaus- 
sian state (O*^. This is done using the following Lemma ifTill : 

Lemma 1. Let f : B{n®^) ~^Rbea lower semi-continuous 
functional (w.r.t. trace norm) which is strongly superadditive 
and invariant under local unitaries f(U^^pU^^^) = f{p)- 
Then, for every density operator p, we have 

f{p) > fip"") 

where p^ is the Gaussian state with the same first- and 
second-order moments as p. 

We apply Lemma 1 to the functional f : p^ Smia{p), with 
N ^ 2 and p being the 2ri-mode state shared by Alice and 
Bob. The three necess^ conditions are verified following the 
same procedure as in yD, where the extremality of Gaussian 
states for the quantity S{a\E) was proved. 

( i) Lower semi-continuity. It is known that for two quantum 
states pAB and (tas, there exist respective purifications pab e 
and aAB e of these states such that Wpab—cab 1 1 1 < e implies 
IIpabb — ctabeWi < 2y/e. Thus, since / does not depend 
on the choice of purification of p, it is sufficient to prove the 
continuity of /{pabe) to infer that of /{pab)- Furthermore, 
since partial trace can only decrease the trace norm and since 
the operator norm 1 1 • 1 1 oo is a lower bound of 1 1 • 1 1 1 , we have 
I PaE ^aE \ \ oc < Wpabe- <^ab b 1 1 1 ■ Hence, one only needs 
to establish the semi-continuity of f{paE) with respect to the 
operator norm. 



Note first that, for a given as, the function paE 



PaE 
0"E 



IS 



clearly continuous, where is the Hermitian operator de- 
fined in Eq. (|6]l. Then, the function paE Aniax(^^) = 
1 1 I loo is continuous with respect to the operator norm, as 
well as the function paE Soo{^^§^) defined in Eq. (|5]l. Fi- 
nally, regarding tr^; as a parameter, the min-entropy S^^i^ {o\E) 
is a lower semi-continuous function of PaE^ being the upper 
envelope of a family of continuous functions, see Eq. Q. 

( ii) Strong super-additivity. This property results from the 
recombination-chain-rule property of the min-entropy lIlSll : 



One has: 

{ai,a2\E) > Smm{ai\a2E) + 5n,in(a2|^^) 

> S^MA2B2E) + S^MA^B.E) 

> S„iiniai\Ei) + S',nm(a2|£'2) 



where the second and third inequalities follow respectively 
from the subadditivity of the min-entropy lIlSll and the fact 
that A2B2E (resp. AiBiE) purifies AiBi (resp. A2B2). 
The additivity of f{p), also needed for Lemma 1 to hold, is a 
consequence of the additivity of the min-entropy [jstl • 

(Hi) Invariance under local unitaries. This property is 
proved following the same steps as in The crucial remark 
is that one can restrict the proof of Lemma [U to some Gaus- 
sification operations that do not mix the x and p quadratures. 
Then, using the fact that the min-entropy is invariant under 
local unitaries, we infer the same property for f{p). 

Smooth min-entropy. The function we are actually inter- 
ested in is S'^;j,(p), i.e., the smooth version of the min-entropy 
'S'min(p), see Eq. (|2]l. Unfortunately, Lemma 1 cannot directly 
be applied to 5'^in(p) because this functional is not known to 
be additive. Nevertheless, we can use Lemma 1 for Sminip) 
and introduce the smoothness by hand in order to prove that 
Gaussian states are approximately extremal for pro- 
vided that e is small enough. More precisely, if we can prove 
that the function e 1-^ S^^^{p) is continuous in e for a given p. 



then one has S^-^{p) > S^-^{p'^) - e', with e' > continu- 
ously tending to zero as e ^ 0. 

We address this issue by taking into account a physical con- 
straint on the mean energy. We first write 



Srr 



1 

(p) > sup S 

o 



PaE 
<7E 



(9) 



S^,MB\C) > S^U^IBC) + S^UB\C). 



(8) 



which is analogous to Eq. ^ except that we have restricted 
the supremum to the compact set K of states cr^; of bounded 
energy; hence, we have a lower bound. Second, we note that 
the function {paE, cte) ^ Soo{^^) is continuous in its two 
inputs. Then, taking the supremum of a continuous function 
Soo{^^) over the compact set K as in Eq. (|9]l yields a con- 
tinuous function, p 1-^ Smin{p)- Thus, in view of Eq. (|2]i, we 
conclude that the function e 1-^ S^j^{p) is continuous, as long 
as we put an energy constraint in the supremum over a e- As is 
obvious from Eq. (|9]l, this energy constraint can only decrease 

Symmetric Gaussian states. Up to here, we have proved 
that the min-entropy can be safely bounded by assuming that 
the state p shared by Alice and Bob is Gaussian. Now, let us 
exploit the fact that p (and p*^) can be considered symmet- 
ric (this property can be enforced with a random permutation 
of Alice and Bob's strings after the quantum transmission, al- 
though this permutation is not needed for symmetric protocols 
such as those of interest here). The permutation-invariance of 
p (or p*^) implies that its covariance matrix F has a symmetric 
form, Eq. Q. If a de Finetti theorem held for infinite dimen- 
sion, one would conclude that such a symmetric state is "close 
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to" a product state. Here, however, we just exploit the Gaus- 
sianity of the state. We apply the symplectic transformation 
S = I2 <8) where X is any orthogonal n x n matrix for 
which Xi i = 1/ \/n, in order to diagonalize F, namely 111 ill : 



/-f+in-lja 



r' = STS^ 



7 — (T 



v 











\ 



7 - cr / 



(10) 

Since S^^^{p'^) is invariant under S, we may consider instead 
of p*^ a Gaussian state which has the diagonal covariance ma- 
trix r' and is thus a genuine product state. Then, the subad- 



ditivity of the smooth min-entropy implies that S^^^{p ) 

(n-l) 



> 



'^miiA/^in 



where is a bimodal Gaussian state with 



covariance matrix 7 — cr. 

Gaussian product states. We are left now with the problem 
of estimating the smooth min-entropy of a Gaussian product 
state. This is done using the following Lemma, stating that 
the smooth min-entropy of a product state asymptotically con- 
verges towards its von Neumann entropy jsl): 

Lemma 2. Let pas G 'Ha ® T^s be a density operator which 
is classical on H-a- Then, for any e > 0, 



1 



S:nME)>S{a\E)~5, 



(11) 



where 5 := {2S,„ax{Pa) + 3)y^ 



l+log(l/e) 



Note that the variable a must be discretized in order to use 
Lemma 2; otherwise, the entropies are ill-defined, as already 
emphasized. Interestingly, Lemma 2 can be rewritten with 
'^minC/^fe) S{a\E) being expressed both as a supremum 
over aE, and, in addition, inequality ( fTTT ) holds for any as 
ist). This implies that restricting the supremum over operators 
(Te E K with a bounded energy does not affect the conver- 
gence towards the von Neumann entropy. 



Finally, applying Lemma 2 to the state 



(n-l) 



and com- 



bining it with the previous inequalities, we get an explicit 
lower bound on the smooth min-entropy of the initial 2n- 
mode state p shared by Alice and Bob, namely 



l)[Sia\E)^S] 



(12) 



where S{a\E) is the conditional von Neumann entropy mea- 
suring Eve's uncertainty when Alice and Bob's state is a Gaus- 
sian state whose covariance matrix is 7 — cr. Therefore, in the 
asymptotic limit n 00, the smooth min-entropy is simply 
bounded by an expression similar to that used when address- 
ing the security against Gaussian collective attacks. This con- 
cludes the unconditional security proof. 

Note that the secret key rate against collective attacks is 
obtained by considering the Gaussian state with the observed 



covariance matrix 7, whereas S{a\E) must be evaluated here 
based on the covariance matrix 7 — cr. Nevertheless it can be 
easily computed since both cr and 7 are experimentally acces- 
sible. In addition, for a QKD protocol with coherent states 
and homodyne detection, one can check that asymptotically, 
7^(7 — cr) > K{'-f). This is proved using the fact that the 
submatrices in (fTOl i should be valid covariance matrices for 
any n. Therefore there is no need to measure cr to establish 
unconditional security, but monitoring cr may lead to a better 
key rate. 

Conclusion. We have proved that the most general attacks 
against continuous-variable quantum key distribution proto- 
cols cannot beat Gaussian collective attacks, up to some finite- 
size corrections which vanish in the limit of a large key size. 
Our proof holds for all protocols based on probing the quan- 
tum channel via the second-order moments of Alice and Bob's 
continuous data. For readability, we only considered direct 
reconciliation, but the generalization of the proof to reverse 
reconciliation lfl6ll is also immediate (the result of Bob's mea- 
surement b should be interchanged with a). 
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